Adds the bin/worker-notifications entrypoint, Dockerfile chmod, and
docker-compose service definitions for the new Notifications worker
without disturbing the existing Mails worker, and re-adds the Mails
queue/class constants on Event so the legacy callers still resolve.
The full mail->notification swap (caller migration, Mails removal,
worker rename) will land as a follow-up.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drop the global _APP_NOTIFICATIONS_WEBHOOK_SECRET env var. There's no
analogous global webhook secret in Appwrite; the existing Webhooks
worker carries a per-webhook signatureKey on the webhook document.
Move the same pattern into the Notification event: each webhook
recipient may carry an optional signatureKey, which the worker
forwards to the Webhook adapter for HMAC-SHA256 signing. Recipients
without a key are delivered unsigned and a tag is logged for audit.
Registers the webhook signing secret in app/config/variables.php under a
new Notifications category, threads it through the worker container in
docker-compose.yml and tests/resources/docker/docker-compose.yml, and
adds an empty default to .env so operators see the knob alongside the
existing SMTP block.
When set, outbound webhook deliveries from the notifications worker
include an X-Appwrite-Webhook-Signature header carrying
sha256=<hex(hmac_sha256(timestamp.body, secret))>. When unset, the
worker delivers payloads unsigned — receivers must decide whether to
accept them.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Resolves GHSA-cfw5-2vxh-hr84 (CVSS 6.3) and GHSA-mwv9-gp5h-frr4
(CVSS 2.7) in astro test resource sites.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Updated docker-compose.yml to use a pre-built PostgreSQL image instead of a custom build.
- Removed obsolete PostgreSQL Dockerfiles from the project.
- Updated composer.lock with a new content hash.
The Postgres adapter in utopia-php/database requires PostGIS, pgvector,
and pg_trgm extensions. The plain postgres:18 image lacked these, causing
"collation utf8_ci_ai does not exist" errors (CREATE EXTENSION failed
before the collation could be created).
Switch to postgres:17 with a custom Dockerfile that installs the required
extensions, matching the approach used by utopia-php/database's own tests.
Also reverts the volume mount to /var/lib/postgresql/data (correct for v17).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The appwrite container's `dns: 172.16.238.100` (CoreDNS) bypassed Docker's
embedded DNS, preventing resolution of service names like `postgresql`.
CoreDNS only handles custom test domains and forwards unknown queries to
Cloudflare, which can't resolve Docker service names.
Fix: Add 127.0.0.11 (Docker embedded DNS) as primary resolver and configure
CoreDNS to forward unknown queries to Docker DNS with Cloudflare as fallback.
Bind CoreDNS to its static IP to avoid port conflict with Docker's DNS proxy.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Jake BarnbyandClaude Opus 4.7
Matej Bačo
Prem Palanisamy
DarshanandPrem Palanisamy
ArnabChatterjee20kandGitHub
ArnabChatterjee20k
HemachandarandGitHub
Hemachandar
copilot-swe-agent[bot]andstnguyen90